diff --git a/OpenEXR/IlmImf/ImfPizCompressor.cpp b/OpenEXR/IlmImf/ImfPizCompressor.cpp index 7a49d42d9..edc141ad9 100644 --- a/OpenEXR/IlmImf/ImfPizCompressor.cpp +++ b/OpenEXR/IlmImf/ImfPizCompressor.cpp @@ -492,7 +492,9 @@ PizCompressor::uncompress (const char *inPtr, // This is the cunompress function which is used by both the tiled and // scanline decompression routines. // - + + const char* inputEnd=inPtr+inSize; + // // Special case - empty input buffer // @@ -503,6 +505,7 @@ PizCompressor::uncompress (const char *inPtr, return 0; } + // // Determine the layout of the compressed pixel data // @@ -549,6 +552,12 @@ PizCompressor::uncompress (const char *inPtr, AutoArray bitmap; memset (bitmap, 0, sizeof (unsigned char) * BITMAP_SIZE); + + if(inPtr + sizeof(unsigned short)*2 > inputEnd) + { + throw InputExc ("PIZ compressed data too short"); + } + Xdr::read (inPtr, minNonZero); Xdr::read (inPtr, maxNonZero); @@ -560,8 +569,14 @@ PizCompressor::uncompress (const char *inPtr, if (minNonZero <= maxNonZero) { - Xdr::read (inPtr, (char *) &bitmap[0] + minNonZero, - maxNonZero - minNonZero + 1); + size_t bytesToRead = maxNonZero - minNonZero + 1; + if(inPtr + bytesToRead > inputEnd) + { + throw InputExc ("PIZ compressed data too short"); + } + +Xdr::read (inPtr, (char *) &bitmap[0] + minNonZero, + bytesToRead); } AutoArray lut; @@ -570,6 +585,11 @@ PizCompressor::uncompress (const char *inPtr, // // Huffman decoding // + if(inPtr + sizeof(int)> inputEnd) + { + throw InputExc ("PIZ compressed data too short"); + } + int length; Xdr::read (inPtr, length);